News & Insight

Employment Law: Out With the Old, in With the New Forms for Employers Using Credit Information in Employment Decisions

As of January 1, any employer that uses an individual’s credit report as grounds for an adverse employment action is required to supply that individual with an updated “Summary of Rights” form under the Fair Credit Reporting Act (“FCRA”). 

The FCRA form was revised to conform to new financial regulations under the 2010 Dodd-Frank Wall Street Reform and Consumer Protection Act. Employers, however, need not worry about any substantive changes to their obligations. The new forms simply replace references to the Federal Trade Commission, which had enforced the FCRA prior to the Consumer Financial Protection Bureau taking jurisdiction. Employers can find the revised form in Appendix K at the end of Title 12 of the Code of Federal Regulations, Part 1022, or simply click here. 

By way of some background, the FCRA limits an employer’s ability to use background checks on employees and potential hires. It is triggered any time an employer uses a third-party consumer reporting agency to gather information such as the subject’s credit worthiness, credit standing, character, general reputation, or mode of living. The FCRA requires employers who request a consumer report to do the following: 

  • Disclose to the applicant/employee that such a report may be obtained. 
  • Receive written permission to obtain the report from the applicant/employee. The consent must be a stand-alone document, not merely a paragraph at the bottom of an application or other document. An employer may obtain a blanket consent at the time of employment or later.  
  • If the employer is considering taking on adverse action against the applicant/employee based on the report, it must provide the individual with a “pre-adverse action” notice, a copy of the consumer report(s) and a copy of the FCRA Summary of Rights. It is this Summary of Rights that must have been updated as of January 1. The individual should be given a recommended five business days to respond to the notification, though this may vary according to state-specific regulations. (To date, Maryland has not issued any such regulation; therefore, Maryland employers should follow the FTC recommendation of five business days.) 
  • If the employer decides to take the adverse action, it must provide the individual with a formal “adverse action” notice. In so doing, the employer must give the individual the name, address, and phone number of the agency that provided the information.

Any violation of these or other provisions of the FCRA could lead to liability for the employer and an award for damages for the employee/applicant. More information on these rules, the FCRA in general, or other consumer financial products and services, is available at the Consumer Financial Protection Bureau at

In addition to the FCRA, Maryland employers who use credit information to make employment decisions should be aware of the Job Applicant Fairness Act (“JAFA”), enacted in 2011. JAFA limits an employer’s right to use credit reports in employment decisions to those positions where the employer “has a bona fide purpose for requesting or using information in the credit report or credit history that is: (1) substantially job-related; and (2) disclosed in writing to the employee or applicant.” The JAFA provides five examples of positions that satisfy this requirement: 

  • A position that is managerial and involves setting the direction or control of a business, or a department, division, unit, or agency of a business; 
  • A position that involves access to personal information of a customer, employee, or employer, except for personal information customarily provided in a retail transaction; 
  • A position of fiduciary responsibility to the employer, including the authority to issue payments, collect debts, transfer money, or enter into contracts; 
  • A position that is provided an expense account or a corporate debit or credit card; or

A position affording access to: (1) information that derives independent economic value, actual or potential, from not being generally known and is the subject of efforts that are reasonable under the circumstances to maintain its secrecy; or (2) other confidential business information.

Like its federal counterpart, the JAFA provides penalties for failure to comply — a civil penalty of up to $500 for an initial violation of these rules, as well as a penalty of up to $2,500 for any repeat violations.

For more information please contact Carolyn Mech at 410-583-2400 or